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1.  Open  Systems 

Problems  and  opportunities  associated  with  describing  and  taking  action  in  "open  systems"  will  be 
increasingly  recognized  as  a  central  line  of  computer  system  development.  In  the  future  many  computer 
applications  will  be  based  on  communication  between  systems  which  will  have  been  developed  separately  and 
independently.  These  systems  are  open  ended  and  incremental-undergoing  continual  evolution.  The  only 
thing  that  the  components  of  an  open  system  hold  in  common  is  the  ability  to  communicate  with  each  other. 
In  this  paper  we  study  description  and  actions  in  Open  Systems  from  the  viewpoint  of  Message  Passing 
Semantics,  a  research  programme  to  explore  issues  in  the  semantics  of  communication  in  parallel  systems. 

In  an  open  system  it  becomes  very  difficult  to  determine  what  objects  exist  at  any  point  in  time.  For 
example  a  query  might  never  finish  looking  for  possible  answers.  If  a  system  is  asked  to  find  all  the  current 
mail  address  of  people  who  have  graduated  from  MIT  since  1930.  it  might  have  a  hard  time  answering.  It  can 
give  all  the  mail  address  it  has  found  so  far.  but  there  is  no  guarantee  that  another  one  can’t  be  found  by  more 
diligent  search.  These  examples  illustrate  how  the  "closed  world  assumption"  is  intrinsically  contrary  to  the 
nature  of  Open  Systems.  We  understand  the  "closed  world  assumption"  to  be  that  the  information  about  the 
world  being  modeled  is  complete  in  the  sense  that  all  and  only  the  relationships  that  can  possibly  hold  among 
objects  are  those  implied  by  the  local  information  at  hand  (cf.  [Reiter  82]).  Systems  based  on  the  "closed 
world  assumption”  typically  assume  that  they  can  find  all  the  instances  of  a  concept  that  exist  by  searching 
their  local  storage.  In  contrast  we  desire  that  systems  be  accountable  for  having  evidence  for  their  beliefs  and 
be  explicitly  aware  of  the  limits  of  their  knowledge.  At  first  glance  it  might  seem  that  the  closed  world 
assumption,  almost  universal  in  the  A.I.  and  database  literature,  is  smart  because  it  provides  a  ready  default 
answer  for  any  query.  Unfortunately  the  default  answers  provided  become  less  realistic  as  the  Open  System 
increases  in  size. 

2.  Message  Passing  Semantics 
2.1.  Descriptions  of  Behavior 

Message  Passing  Semantics  builds  on  Actor  Theory  as  a  foundation.  Actor  Theory  describes  important 
aspects  of  parallelism  and  serialization  from  the  view  point  of  message  passing  objects.  It  goes  beyond  the 
sequential  coroutine  message  passing  developed  in  systems  like  Simula  and  Small  Talk.  An  actor  system  is 
composed  of  abstract  objects  called  actors.  Actors  arc  defined  by  their  behavior  when  they  accept 
communications.  When  a  communication  is  accepted  an  actor  can  perform  the  following  kinds  of  actions 
concurrently:  make  simple  decisions  (such  as  whether  some  actor  it  received  in  the  communication  is  the 
same  as  one  of  its  acquaintances),  create  new  actors,  transmit  more  communications  to  its  own  acquaintances 
as  well  as  the  acquaintances  of  the  communication  accepted,  and  change  its  behavior  for  the  next  message 


accepted  (i.c.  change  us  local  suite)  subject  to  die  constraints  of  certain  laws  [Mew  ill.  Biker  77J. 

Below  we  describe  the  behavior  of  a  simple  actor  which  is  a  shared  checking  account  which  we  will  call 
ACC0UNT43.  One  kind  of  description  might  be  a  partial  description  of  what  happened  when  the  actor 
ACC0UNT43  with  a  balance  of  $10  accepted  a  request  to  make  a  deposit  with  amount  $2  for  customer  c2,  and 
as  a  result  created  the  actor  $12.  sent  a  Completion  report  to  c2.  and  became  an  account  with  balance  $12: 


ACC0UNT43 


Figure  2*1:  A  Happening 

l^atcr  in  the  paper  we  will  describe  how  the  behavior  of  an  actor  is  written  in  the  language  Act2. 


2.2.  Shared  Resources 

Ihc  modeling  of  shared  resources  is  fundamental  to  Open  Systems.  Actor  systems  aim  to  provide  a  clean 
way  to  implement  effects  (not  "side-effects"  a  pejorative  term  that  has  been  used  as  a  kind  of  curse  by 
proponents  of  purely  applicative  programming  in  the  lambda  calculus).  By  an  effect  we  mean  a  local  state 
change  in  a  shared  actor  which  causes  a  change  in  behavior  that  is  visible  to  other  actors.  For  example 
sending  a  deposit  to  an  account  shared  by  multiple  users  should  have  the  effect  of  increasing  the  balance  in 


the  account 

ACCOUNT43  is  an  example  of  the  kind  of  shared  resource  which  is  important  in  the  conceptual  modeling 
of  Open  Systems.  Such  shared  resources  should  be  suitable  for  use  by  a  growing  collection  of  users.  To  a 
given  user,  a  shared  account  will  exhibit  indeterminacy  in  the  balance  depending  on  the  deposits  and 
withdrawals  made  by  other  users.  The  indeterminacy  arises  from  the  indeterminacy  in  the  arrival  order  of 
messages  at  the  shared  account  A  common  bug  in  attempting  to  model  computation  in  open  systems  is  to 
assume  that  an  agent  sending  messages  can  determine  the  order  in  which  they  will  be  seen  by  the  recipient.  It 
is  important  to  realize  that  the  above  assumption  is  contrary  to  the  nature  of  Open  Systems.  Also 
implementing  shared  resources  inherently  involves  being  open  to  outside  communications,  even  those  put 
forth  by  parties  which  joined  the  Open  System  after  the  request  being  considered  was  received. 


13.  Multiple-Inheritance 

A  description,  such  and  (a  SharedAccount),  can  inherit  attributes  and  behavior  from  other 
descriptions.  In  this  example,  a  shared  account  inherits  from  both  the  description  of  an  Account  and  the 
description  of  a  Possess  1  on. 


fan  Account 

fwlth  balance  (ah  Amount))) 


(A  Possession 

(with  owners  (a  Set)))) 


(A  SharedAccount) 

Figure  2-2:  Multiple  Inheritance 

Dealing  with  the  issues  raised  by  the  possibility  of  being  a  specialization  of  more  than  one  description  has 
become  known  as  the  "Multiple  Inheritance  Problem".  »A  number  of  approaches  have  been  developed  in  the 
last  few  years  including  the  following:  (Weinrcb,  Moon  81),  [Curry,  Baer,  Lipkie,  Lee  82],  [Boming,  Ingalls 
82],  (Bobrow,  Stcfik  82]  and  [Borgida,  Mylopoulos,  Wong  82].  Our  approach  differs  in  (hat  it  builds  on  the 
theory  of  an  underlying  description  system  [Attardi,  Simi  81).  'Phis  theory  axiomatizes  the  relationship 
between  the  multiple  inherited  descriptions.  This  theory  also  maintains  the  parallelism  inherent  in  actor 
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theory,  and  thus  is  suitable  for  describing  highly  distributed  open  systems. 

2.4.  Change 

The  degree  of  parallelism  is  partially  determined  by  whether  the  actor  can  change  its  local  state  or  not. 
Actors  which  can  change  their  local  state  arc  called  serialized  actors.  A  serialized  actor  accepts  only  one 
message  at  a  time  for  processing;  it  will  not  accept  another  message  for  processing  until  it  has  dealt  with  the 
one  which  it  has  received.  A  communication  received  by  a  serialized  actor  is  processed  in  order  of  arrival; 
although,  not  necessarily  in  the  order  sent  Actors  which  can  never  change  their  local  state  are  called 
unserialized  actors.  These  actors  are  able  to  process  arbitrarily  many  messages  at  the  same  time.  Actors  such 
as  the  square  root  function  and  the  text  of  Lincoln’s  Gettysburg  Address  are  unserialized. 

Open  systems  do  not  have  well  defined  global  states.  Effects  are  implemented  by  an  actor  changing  its  own 
local  stale  using  a  become  command  [Hewitt,  Attardi.  Lieberman  79).  There  are  no  assignment  commands. 
Our  conceptual  model  of  change  contrasts  with  the  usual  computer  science  notion  in  which  change  is 
modeled  by  updating  the  state  components  of  a  universal  global  state  [Milne.  Strachey  76).  The  absence  of  a 
well  defined  global  state  is  a  fundamental  difference  between  the  actor  model  and  classical  sequential  models 
of  computation  (viz.  [Turing  37),  [Church  41).  etc.)  Actor  systems  can  perform  nondeterministic  computations 
for  which  there  is  no  equivalent  nondeterministic  Turing  Machine  [ Clingcr  81).  The  noncquivalcnce  points  up 
the  limitations  of  attempting  to  model  parallel  systems  as  nondeiciminisuc  sequential  machines  [Milne. 
Strachey  76).  This  is  not  to  say  that  actor  systems  can  implement  functions  which  are  not  recursively 
computable  (like  solving  the  Halting  Problem).  Instead  (he  point  is  that  recursive  functions  do  not  provide  an 
adequate  model  of  parallelism.  I.E.  an  Open  System  cannot  be  adequately  modeled  as  a  recursive  function 
which  maps  global  states  to  global  states  because  at  any  given  point  in  time  an  Open  System  does  not  in 
general  have  a  well  defined  global  state.  Will  Clingcr  has  developed  an  elegant  mathematical  theory  [Clinger 
81)  (called  Actor  Theory)  which  accounts  for  capabilities  of  actor  systems  which  go  beyond  those  of 
nondeterministic  Turing  Machines.  We  claim  that  nondeterministic  Turing  machines  are  an  unsatisfactory 
model  of  the  computational  capabilities  of  large-scale  open  systems. 

25.  Concurrency 

Concurrency  in  Open  Systems  stems  from  the  parallel  operation  of  an  incrementally  growing  number  of  . 
multiple,  independent,  communicating  agents.  Sites  can  join  an  Open  system  in  the  course  of  its  normal 
operation-sometimes  even  affecting  the  results  of  computations  initiated  before  they  joined.  Actor  Theory 
has  been  designed  to  accurately  model  the  computational  properties  of  Open  Systems.  It  is  a  consequence  of  the 
Actor  Model  that  purely  functional  programming  languages  based  on  the  lambda  calculus  cannot  implement 
•-hared  accounts  in  Open  Systems.  The  continuation  technique  promoted  by  Strachey  and  Milne  [Milne, 
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Sirachcy  76)  for  simulating  some  kinds  of  parallelism  in  the  lambda  calculus  does  not  apply  u  Open  Systems. 
The  lambda  calculus  simulation  is  sequential  whereas  Open  Systems  are  inherently  parallel.  Concurrency  in 
the  lambda  calculus  stems  from  the  concurrent  reduction/evaluation  of  various  parts  of  a  single  lambda 
expression  with  an  environment  which  is  fixed  when  the  lambda  expression  is  created.  In  Open  Systems 
independent  agents  can  incrementally  and  independently  spawn  ongoing  computations  so  the  evaluation  of 
an  expression  can  be  affected  by^ctions  which  were  initiated  after  the  evaluation  of  the  expression  is  begun. 

16.  Truth  and  behavior 

Message  Passing  Semantics  takes  a  different  perspective  on  the  meaning  of  a  sentence  from  that  of  truth* 
theoretic  semantics.  In  truth*theoretic  semantics  (Tarski  44],  the  meaning  of  a  sentence  is  determined  by  the 
models  which  make  it  true.  For  example  the  conjunction  of  two  sentences  is  true  in  a  model  exactly  in  which 
both  of  its  conjuncts  are  true  in  the  model.  In  contrast  Message  Passing  Semantics  takes  tne  meaning  of  a 
message  to  be  the  effect  it  has  on  the  subsequent  behavior  of  the  system.  In  other  words  the  meaning  of  a 
message  is  determined  by  how  it  affects  the  recipients.  Each  partial  meaning  of  a  message  is  constructed  by  a 
recipient  in  terms  of  how  it  is  processed  (c.f.  (Reddy  79]).  The  meaning  of  a  message  is  open  ended  and 
unfolds  indefinitely  far  into  the  future  as  other  recipients  process  the  message. 

At  a  deep  level,  understanding  always  involves  categorization,  which  is  a  function  of  interactional  (rather 
than  inherent)  properties  and  the  perspective  of  individual  viewpoints.  Message  Passing  Semantics  differs 
radically  from  truth-theoretic  semantics  which  assumes  that  it  is  possible  to  give  an  account  of  truth  in  itself, 
free  of  interactional  issues,  and  that  the  theory  of  meaning  will  be  based  on  such  a  theory  of  truth  (Lakoff, 
Johnson  80]. 

3.  Description  and  Action 
3.1.  Limitations  of  Descriptions 

The  dwrinctinn  between  doing  and  describing  is  different  from  the  usual  distinction  made  in  the  Artificial 
Intelligence  literature  (McCarthy,  Hayes  69]  (Hayes  77]  between  the  epistemological  adequacy  of  a  system  (its 
accuracy  with  respect  to  truth-theoretic  semantics  (Tarski  44])  and  the  heuristic  adequacy  (the  efficiency  of  its 
inferential  procedures  in  proving  theorems).  Thus  the  distinction  between  epistemological  adequacy  and 
heuristic  adequacy  is  founded  on  the  basis  of  truth-theoretic  semantics.  Our  simple  example  can  help  clarify 
the  distinction.  An  epistemologically  adequate  theory  of  financial  accounts  gives  an  accurate  description  of 
the  rules  that  govern  them.  An  hcuristically  adequate  system  can  derive  theorems  in  the  theory  of  financial 
accounts  fast  enough  to  answer  queries.  Both  kinds  of  adequacy  are  concerned  with  the  description  of 
financial  accounts:  the  former  with  its  accuracy;  the  later  with  the  efficiency  with  which  the  description  can  be 
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used  to  answer  questions. 

Neither  kind  of  adequacy  actually  accomplishes  creating  a  shared  account  with  $10  in  it  so  a  growing  set  of 
geographically  dispersed  users  can  make  deposits  and  withdrawals.  We  could  ‘describe  a  certain  kind  of 
account  with  an  axiom  such  as  the  following: 

( ( d  >  0)  implies 

(repl ies-af ter-acceptance 

(a  SharedAccount  (with  balance  b)) 

(j»  Deposit  (with  amount  d)) 

(3.  CompletionReport 

(with  ResultingBalance  (b  +  d ) ) ) ) ) 

where  the  variables  b  and  d  are  universally  quantified  and  the  predicate  repl  ies-af  ter-acceptance 
takes  three  arguments  which  are  a  description  of  the  local  state  of  an  actor  when  it  accepts  a  request  message, 
a  description  of  the  request  accepted,  and  a  description  of  the  reply  to  the  request,  respectively.  Now  it 
should  be  clear  that  hypothesizing  that  ACCOUNT 43  satisfies  the  following  description: 

(l  SharedAccount 

(with  InitialBalance  $20) 

(with  Place  BankOfLondon) 

(with  Time  "Midnight,  December  31.  1987")) 

does  not  by  itself  actually  create  such  an  account  Indeed  the  above  assertion  is  ambiguous  between  the 
following  interpretations: 

-  Hypothesis  Interpretation :  We  have  just  discovered  that  ACC0UNT43  is  already  such  an  account 
and  want  to  explicitly  record  this  in  the  data  base. 

•  Goal  Interpretation:  We  want  to  declare  our  goal  of  having  ACCOUNT 43  be  such  an  account  and 
we  will  devote  some  effort  to  establishing  the  goal 

To  actually  create  the  account  requires  providing  the  money  for  the  initial  deposit  in  the  account.  Making 
assertions  by  itself  will  not  suffice.  Similarly  asserting  the  ACCOUNT43  is  not  a  SharedAccount  docs  not 
in  itself  destroy  an  account  which  is  located  elswhere. 


3.1  Taking  Action 

Knowing  that  something  is  true  and  taking  action  to 'make  it  come  true  are  two  different  things.  Both  are 
important  and  they  should  not  be  confused  In  this  section  we  discuss  how  actors  can  take  action  to  supplement 
the  previous  sections  discussion  of  how  they  can  manipulate  descriptions. 


Actions  such  as  creating  a  new  shared  account  with  balance  $12  and  owner  Ken  can  he  performed  by 
.  -aluating  an  expression  such  as  the  one  below  in  the  programming  language  Act2  (Theriault  83],  [Licbcrman 
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81a]: 

( new  SharedAccount 
(with  Balance  $12) 

(with  Owners  {Ken})) 

Below  we  present  parr  of  the  implementation  of  Sharedaccount. 

(Define  (new  SharedAccount 
(with  balance  «b) 

(with  owners  *s ) ) 

(CMAtfl 

(is-reouest  (a  balance)  & 

(reolv  (a  SharedAccount 

(with  balance  b)})) 

(is-reouest  (a  deposit 

(with  amount  *a)  do 
( become  (new  SharedAccount 

(with  balance  (+  b  a)))) 

( reply  (a  deposit-receipt 

(with  amount  a))))) 


))) 


At  this  point  we  would  like  to  take  note  of  several  unusual  aspects  of  the  above  implementation.  The 
ACT2  language  is  an  open  system,  ie.  each  command  and  expression  parses  and  evaluates  itself.  New 
commands  and  expressions  can  easily  be  added  to  the  language.  They  are  also  actors,  so  they  can  execute  in 
parallel.  For  example,  in  the  communication  handler  for  Deposit  requests  above,  the  following  two 
commands  are  executed  concurrently: 

( become  ( new  SharedAccount 

(with  balance  (+  b  a)))} 

(reply  (a  deposit-receipt 
(with  amount  a))) 

The  principle  of  maximizing  concurrency  is  fundamental  to  the  design  of  actor  programming  languages.  It 
accounts  for  many  of  the  differences  with  conventional  languages  based  on  communicating  sequential 
processes. 


.kvva: 


"*•*»"*  «  *  *  *_•  * 
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4.  Related  Work 


The  object-oriented  programming  languages  (c.g.  (Birtwistle,  Dahl,  Myhrhaug,  Nygaard  73],  [IJskov, 
Snyder,  Atkinson.  Schaffert  77],  (Shaw,  Wulf,  London  77],  and{lchbiah  80])  arc  built  out  of  objects 
(sometimes  called  "data  abstractions")  which  are  completely  separate  from  the  procedures  in  the  language. 
Similarly  the  lambda  calculus  programming  languages  (c.g.  (McCarthy  62],  [Landin  65],  (Friedman,  Wise  76], 
[Backus  78],  and  [Steele,  Sussman  78])  are  built  on  functions  and  data  structures  (viz.  lists,  arrays,  etc.)  which 
arc  separate.  SmallTalk  [Ingalls  78]  is  somewhat  a  special  case  since  it  simplified  Simula  by  leaving  out  the 
procedures  entirely,  i.e.  it  has  only  classes.  The  Simula-like  languages  provide  effective  support  for  coroutines 
but  not  for  concurrency.  In  contrast  the  Actor  Model  is  designed  to  aid  in  conceptual  modeling  of  shared 
objects  in  a  highly  parallel  open  systems.  Actors  serve  to  provide  a  unified  conceptual  basis  for  functions, 
data  structures,  classes,  suspensions,  futures,  procedure  invocations,  exception  handlers,  objects,  procedures, 
processes,  etc.  in  all  of  the  above  programming  languages  [Baker.  Hewitt  77],  [Licbcrman  81b],  (Hewitt, 
Attardi,  Lieberman  79].  For  example  sending  a  request  communication  generalizes  the  traditional  procedure 
invocation  mechanism  which  requires  that  control  return  to  the  point  of  invocation.  A  request 
communication  contains  the  mail  address  of  a  customer  to  which  the  response  to  the  request  should  be  sent  as 
well  as  the  message  specifying  the  task  to  be  performed.  In  this  way,  exception  handlers  [Liskov,  Snyder, 
Atkinson,  Schaffert  77],(Ichbiah  80]  and  co-routines  [Birtwistle.  Dahl,  Myhrhaug.  Nygaard  73]  are 
conveniently  unified  with  other  more  general  control  structures.  The  Actor  Model  unifies  the  conceptual 
basis  of  the  lambda  calculus  and  the  object-oriented  schools  of  programming  languagcs-being 
mathematically  defined,  it  is  independent  of  all  programming  languages. 

Prolog  based  systems  such  as  Intermission  [Kahn  82]  and  Concurrent  prolog  [Shapiro  83]  are  pragmatically 
useful  and  interesting  experiments  in  their  own  right.  Unfortunately,  neither  as  yet  has  a  well  developed 
mathematical  semantics  which  would  make  it  possible  to  directly  analyze  them  as  we  have  done  for  the 
lambda  calculus  and  first  order  logic.  To  the  extent  that  Intermission  and  Concurrent  Prolog  are  based  on  first 
order  logic  and  the  lambda  calculus,  they  inherit  limitations  discussed  in  this  paper. 

5.  Conclusion 

The  fundamental  thesis  of  this  paper  is  that  knowing  that  something  is  the  case  and  taking  action  to  make  it 
the  case  are  two  different  things  which  should  not  be  confused.  Asserting  a  proposition  P  can  mean  that  we 
have  established  that  P  is  the  case  and  want  to  explicitly  record  this  in  the  data  base.  Or  it  can  mean  that  we 
want  to  declare  that  P  is  our  goal  and  we  will  devote  some  effort  to  planning  how  to  do  it.  Neither  of  the 
above  possibilities  inherently  involves  taking  any  action.  'Die  capability  to  take  action  as  well  as  to  describe 
the  world  is  very  important.  Ihe  relationships  between  description  and  action  arc  quite  subtle. 
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M  V*  claim  that  odors  ( unlike  lambda  expressions,  logical  implications,  etc.)  arc  the  universal  objects  of 
concurrent  systems  and  that  they  can  serve  as  a  efficient  interface  between  the  hardware  and  software.  Actors 
provide  an  absolute  conceptual  interface  between  the  software  and  hardware  of  parallel  computer  systems. 
'Die  function  of  the  hardware  is  to  efficiently  implement  the  primitive  actors  and  the  ability  to  communicate 
in  parallel.  Software  systems  in  turn  can  be  implemented  in  terms  of  actors  completely  independently  of  the 
hardware  configuration.  The  actor  concept  itself  is  defined  mathematically  and  is  thus  logically  independent 
of  all  programming  languages  and  hardware  architectures.  A  system  consisting  of  multiple  processors 
--  called  the  APIARY  -  is  being  developed  to  use  the  inherent  parallelism  of  actor  systems  to  increase  the 
efficiency  of  computation  [Hewitt  80]. 

Message  Passing  Semantics  deals  coherently  with  both  doing  and  describing  whereas  truth*theoretic 
semantics  only  addresses  some  of  the  issues  of  describing.  We  claim  that  it  is  impossible  to  implement  shared 
resources  for  Open  Systems  using  description  systems  such  as  first  order  logic  and  the  lambda  calculus 
because  they  lack  the  necessary  communication  capabilities. 

Description  languages  based  on  first  order  logic  and/or  the  lambda  calculus  have  been  designed  to  express 
properties  but  are  incapable  of  taking  action.  On  the  other  hand  procedural  languages  (such  as  current 
dialects  of  Lisp  and  Ada)  have  been  designed  to  efficiently  take  action  but  they  suffer  firom  a  lack  of 
descriptive  capabilities.  We  need  good  ways  to  integrate  the  roles  of  descriptions  and  actions  in  our  systems. 
Some  of  the  ideas  in  this  paper  have  been  applied  to  the  analysis  of  the  relationship  between  the  roles  of 
descriptions  and  actions  in  organizational  work  [Barber,  de  Jong,  Hewitt  83]. 
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